How to get the size of a lookup file from Splunk search

[lucas4394]

Hi all,

Does anyone know how to get the file size of a lookup file from Splunk search?

thanks.

[morethanyell]

Please try this new custom command I built:

https://splunkbase.splunk.com/app/6735

[jawaharas]

Not a efficient way but works. But you need to input list of field names from the CSV file. And the file size may be accurate as it's based on number of characters.

| inputlookup myfile
| fillnull value=NULL
| eval all_fields=field1 . field2 . field3
| eval raw_len=len(all_fields) 
| stats sum(raw_len) as total_char
| eval size_in_bytes=round(total_char/1024,2)

[stevem]

A little nicer would be to use foreach, some options but example-

| foreach * [ | eval bytes_<<FIELD>>=len(<<FIELD>>)+1 ]
| addtotals bytes_* fieldname=bytes_row | eval bytes_row=bytes_row+1
| stats sum(bytes_row) as bytes_total

[jawaharas]

@lucas4394
Can you accept the answer if it's helped you? Thanks.